tutor answers step by step in plain text, islands finish, and the audit's money and login holes are closed

Tutor (prompt tutor-v3-stepwise-plain): plain text instead of LaTeX/markdown,
with rag/services/mathtext.py converting whatever still slips through; full
step-by-step solutions with a check before the final answer; three tones by
grade; the last 6 messages of the conversation go to the model and follow-ups
are no longer served from another user's cache; book solutions the checker
disputes are kept out of the context; a questionId gives the tutor the
practice question and the student's wrong answer. /api/health reports when
the AI credit runs out. rag_model_benchmark compares chat models on verified
book problems (run on the server; credit ran out mid-run).

Map: only lessons that have questions count toward finishing an island,
lessonIds[0] / nextLessonId is always the next lesson to play, and a finished
island stays finished. The Seyar characters (sigma/delta/pi) are seeded.

Audit fixes, each reproduced before fixing:
- the plan is stored on the order, so paying a monthly order after starting
  a yearly checkout no longer grants a year
- opening checkout no longer demotes an active subscription; renewals extend
  from the current expiry; expired subscriptions are not reported active
- one discount code per order and only before the gateway; a 100% code
  completes the purchase; lost Zarinpal confirmations are re-verified
- the unused /api/payment/webhook "mark paid" endpoint is removed
- XP counts only answers recorded on the server
- 6-digit OTP, each code dies after 5 wrong guesses; POST /api/auth/logout
- a guest who signs up keeps their account and progress (test phones excluded)
- affiliate commission on the first real payment; guests excluded
- parents with several children no longer get a 500
- SQLite runs transactions IMMEDIATE, since it ignores select_for_update
- admin login is rate-limited; display names drop phone numbers and links;
  userQuestion is capped at 2000 characters
- server-side heart enforcement exists behind HEARTS_ENFORCED (off until the
  frontend handles 403 no_hearts)

Not done on purpose: rotating the server's secret key and moving to Postgres.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

accounts/tests.py

@@ -194,20 +194,18 @@ class RequestOTPViewTests(TestCase):
         self.assertTrue(OTPCode.objects.filter(phone='+989120000002').exists())
 
     @override_settings(DEBUG=True)
-    def test_generated_otp_is_always_a_4_digit_string_with_leading_zeros(self):
-        # ⚠️ فیکسِ این تست: تولیدِ OTP از random.randint به secrets.randbelow
-        # تغییر کرده؛ این تست مطمئن می‌شه فرمتِ ۴ رقمی (با صفرهای ابتدایی
-        # حفظ‌شده، نه یک عددِ کوتاه‌تر) دست‌نخورده مونده.
+    def test_generated_otp_is_always_a_6_digit_string_with_leading_zeros(self):
+        # ۶ رقم از ۲۰۲۶-۰۹-۲۵ (با ۴ رقم حدس زدن عملی بود)؛ صفرهای ابتدایی باید بمانند.
         with patch('accounts.views.secrets.randbelow', return_value=7):
             with patch('accounts.views.send_otp_sms'):
                 response = self.client.post(
                     '/api/auth/otp/request', {'phone': '+989120000003'}, format='json',
                 )
         self.assertEqual(response.status_code, 200)
-        self.assertEqual(response.data['devOtp'], '0007')
+        self.assertEqual(response.data['devOtp'], '000007')
         otp = OTPCode.objects.get(phone='+989120000003')
-        self.assertEqual(otp.code, '0007')
-        self.assertEqual(len(otp.code), 4)
+        self.assertEqual(otp.code, '000007')
+        self.assertEqual(len(otp.code), 6)
         self.assertTrue(otp.code.isdigit())
 
 
@@ -245,11 +243,11 @@ class RequestOTPStaleInvalidationTests(TestCase):
     @override_settings(DEBUG=True, OTP_REQUEST_PHONE_COOLDOWN_SECONDS=0)
     def test_second_request_invalidates_first_otp(self):
         phone = '+989121110001'
-        first_code = self._request_otp(phone, '1111')
+        first_code = self._request_otp(phone, '111111')
         first_otp = OTPCode.objects.get(phone=phone, code=first_code)
         self.assertFalse(first_otp.is_used)
 
-        self._request_otp(phone, '2222')
+        self._request_otp(phone, '222222')
 
         first_otp.refresh_from_db()
         self.assertTrue(first_otp.is_used)
@@ -257,8 +255,8 @@ class RequestOTPStaleInvalidationTests(TestCase):
     @override_settings(DEBUG=True, OTP_REQUEST_PHONE_COOLDOWN_SECONDS=0)
     def test_newest_otp_still_works_for_login(self):
         phone = '+989121110002'
-        self._request_otp(phone, '1111')
-        second_code = self._request_otp(phone, '2222')
+        self._request_otp(phone, '111111')
+        second_code = self._request_otp(phone, '222222')
 
         response = self.client.post(
             '/api/auth/login', {'phone': phone, 'otp': second_code}, format='json',
@@ -268,8 +266,8 @@ class RequestOTPStaleInvalidationTests(TestCase):
     @override_settings(DEBUG=True, OTP_REQUEST_PHONE_COOLDOWN_SECONDS=0)
     def test_older_otp_is_rejected_after_new_request(self):
         phone = '+989121110003'
-        first_code = self._request_otp(phone, '1111')
-        self._request_otp(phone, '2222')
+        first_code = self._request_otp(phone, '111111')
+        self._request_otp(phone, '222222')
 
         response = self.client.post(
             '/api/auth/login', {'phone': phone, 'otp': first_code}, format='json',